Use the right model validators

Not possible to do application level token validation since token
is built after validation, nor is it possible to check this.

However database level should be good enough.

Rewrite unit tests to use shoulda